PALV2(Performance Analysis of Logs) Tool

PAL v2.0 is an easy to use tool which simplifies the analysis of Microsoft Performance Monitor Logs (.blg | .csv). It generates an HTML report containing graphical charts and alerts of the performance counters using known thresholds.
Execute the PAL icon in your Start Programs menu or run the PAL.ps1 script from a PowerShell.
Tested on Windows 7 and Windows 8, but should work on Windows Server 2008 R2 and Windows Server 2012. Not recommended or tested on Windows XP and Windows Server 2003 since these operating systems cannot open counter logs captured on Windows Vista and Windows Server 2008 and later.

Run the PAL setup MSI file that ships in the zip file at

Required Products (free and public):

Microsoft .NET Framework 3.5 Service Pack 1 (already on Windows 7 and Windows 8) (full package – no internet access required)

Microsoft Chart Controls for Microsoft .NET Framework 3.5

PowerShell v2.0 (Windows Management Framework (Windows PowerShell 2.0, WinRM 2.0, and BITS 4.0)) (already on Windows 7 and Windows 8)

Warning: The PAL installer (MSI) will set the PowerShell execution policy to unrestricted. This will allow the execution of PowerShell scripts.

Globalization Known Issue: PAL has only been tested using an English-US locale. If you have problems using PAL v2.x, then try again using an English-US locale. This is an open source and voluntary project, so any assistance with globalization and localization is appreciated.

Big thank you to the Microsoft Premier Field Engineering (PFE) organization for the great support and feedback!


Threshold file update: Logical Disk Overwhelmed and Physical Memory Overwhelmed updated to use Avg. Disk Queue Length instead of % Idle Time to determine if the disk queue is busy when checking the other counters.
HTML report update: Changed Alerts to separate criticals and warnings with color.
Processing update: The file name of the counter log and the number of running threads now show in the progress bar during analysis.
Multi-threaded hang condition: When using more than one thread for analysis, the tool might hang. This has been fixed.
Threshold file update: Updated the System Overview threshold file. The Process Processor analyses now have thresholds associated with overall system processor time.
Threshold file update: In the Quick System Overview threshold file, I rewrote the Pool Paged and Pool Nonpaged analyses. Previously they assumed Windows Server 2003. Now, it includes all Microsoft Windows and Windows Server operating systems from Windows XP/Windows Server 2003 and later.
Question variables changed: Number of Processors was removed from Quick System Overview, but other threshold files might still need it – analyses that used this variable now use the \Processor(*)\% Processor Time counter instances. “OS” added to identify the architecture and operating system of the computer in the counter log. “UserVa” added to know what the /USERVA boot.ini switch value was or what the IncreaseUserVa value is on Windows Vista and Windows Server 2008 and later.
Bug fix: Low priority processing now works on all child threads (sessions).


Bug fix: When using more than one thread, PAL will go into an infinite loop (hang) if one or more analyses are disabled in one or more of the threshold files being processed. Fixed.
Threshold file update: Added Disk Overwhelmed analysis to the Quick System Overview threshold file.
Chart layout changes: To better accommodate copying and pasting into Microsoft Word, the legend has been moved to the bottom of the chart and the chart width has change to 620 pixels. Frank Balaguer (Microsoft PFE) inspired the changes. Also, the chart title’s font has been increased from 8 to 12 to be in better proportion to the chart.
SQL Server 2008 R2 threshold file update: David Pless has provided an update to the Microsoft SQL Server 2008 R2 threshold file.


Posted on December 16, 2014, in Windows. Bookmark the permalink. Leave a comment.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

%d bloggers like this: